The vulnerability in the WordPress WP Quiz plugin arises from insufficient sanitization of user‑supplied data before rendering it in web pages, which allows attackers to inject malicious scripts that are stored and later executed whenever a page is viewed. This stored cross‑site scripting can lead to cookie theft, defacement or redirection, and may compromise user sessions or expose sensitive information. The weakness corresponds to CWE‑79.

The defect affects the MyThemeShop WP Quiz plugin for WordPress, for all releases up to and including version 2.0.10. Sites running any of these versions are vulnerable when the plugin’s quiz or response fields accept user input that is not properly escaped before output.

The CVSS score of 6.5 indicates a medium‑severity risk, and the EPSS score of less than 1% suggests exploitation is unlikely at present. The vulnerability is not listed in CISA’s KEV catalogue. Attackers would typically need to craft quiz content or responses to embed malicious payloads; once inserted, the script runs in the context of site visitors. The limited exploitation probability and absence from KEV reduce the imminent threat, but the impact remains significant for any compromised user.